SFARP:一种多层实时安全框架,用于SD-IoT网络中的混合ARP和DDoS攻击防御
Ameer El-Sayed1, Hagar Ramadan2, Ehab R Mohamed2
1Department of Information Technology, Faculty of Computers and Informatics, Zagazig University, Zagazig, 44511, Egypt. aegouda@fci.zu.edu.eg.
Scientific reports
|December 9, 2025
概括
本研究介绍了SFARP,它是软件定义物联网 (SD-IoT) 网络的新型安全框架,可以有效地实时检测和减轻复杂的多向量网络攻击. SFARP增强了对不断变化的威胁的网络防御.
科学领域:
- 网络安全 网络安全
- 网络安全 网络安全
- 物联网 (IoT) 的物联网 (IoT) 的物联网.
背景情况:
- 软件定义物联网 (SD-IoT) 网络面临着由于快速扩张和复杂的多向量攻击 (例如,DDoS,ARP伪造) 的不断升级的漏洞.
- 现有的防御通常被适应性,序列性和混合攻击行为绕过,利用静态控制平面和集中式架构.
- 迫切需要实时,可扩展和适应性安全解决方案,以适应SD-IoT环境的独特挑战.
研究的目的:
- 提出和评估SFARP,一个多层实时安全框架,旨在提高SD-IoT网络对先进网络威胁的弹性.
- 证明框架在检测和减轻各种攻击,包括混合和多向量情景的能力.
- 评估拟议解决方案的硬件可行性和可扩展性,以便在运营商级物联网基础设施中实际部署.
主要方法:
- SFARP集成了三个模块:使用P4编程交换机进行特征提取的动态流量分析模块 (DFAM),使用机器学习分类器进行异常检测的自适应动态流量检测系统 (ADFDS) 和用于协调防御的分布式自适应缓解系统 (DAMS).
- 该框架针对12个复杂的攻击场景进行了评估,包括混合,自适应,模仿和连续攻击,使用5个现实世界物联网数据集 (CICIoMT2024,CICIoT2023,IoTID20,Edge-IIoTset,TON_IoT).
- 硬件可行性被评估在NetFPGA和Tofino ASIC上,以及系统级性能指标,如控制器CPU使用量,数据包丢失和检测延迟.
主要成果:
- 在CICIoMT2024数据集上,SFARP表现出卓越的性能,ADFDS在CICIoMT2024数据集上达到高达98.3%的准确性和2.3%的错误报警率 (FAR),超过了CICIoT2023.23上的最先进模型.
- 系统层面的好处包括控制器CPU使用量减少70%以上,数据包丢失减少90%,端到端检测延迟低于50ms,即使在高容量攻击中也是如此.
- 硬件评估证实了运营商级可扩展性,支持超过25万个并发流程,内存开销最小,验证了SFARP的实际可行性.
结论:
- SFARP提供了一个可扩展,硬件可行和有效的解决方案,用于实时保护SD-IoT基础设施免受不断发展的混合和多层攻击.
- 可编程数据平面遥测,自适应式ML驱动检测和分布式缓解的整合为异质物联网部署提供了强大的安全姿态.
- 这一框架在保护关键物联网生态系统免受日益复杂的网络威胁方面取得了重大进展.
相关概念视频
Radial System Protection
410
Radial systems employ time-delay overcurrent relays to reduce load interruptions. When a fault occurs, the nearest breaker opens first, while upstream breakers remain closed due to longer delay settings. This approach ensures minimal disruption to the rest of the system.
In a radial system with a fault downstream of the third breaker, ideally, only the third breaker will open, isolating the fault and interrupting the load connected beyond it. The second breaker has a longer delay setting,...
In a radial system with a fault downstream of the third breaker, ideally, only the third breaker will open, isolating the fault and interrupting the load connected beyond it. The second breaker has a longer delay setting,...
410
Zones of Protection
739
In power systems, the entire setup is divided into protective zones to isolate faults and protect the rest of the network. These zones include generators, transformers, buses, transmission lines, distribution lines, and motors. Each zone can be visualized as a separate room in a house, with each room protected by its own circuit breaker.
Protective zones are defined by closed dashed lines, containing one or more components. A key characteristic of these zones is the strategic placement of...
Protective zones are defined by closed dashed lines, containing one or more components. A key characteristic of these zones is the strategic placement of...
739
Masking and Demasking Agents
3.4K
EDTA titrations may necessitate masking and demasking agents to temporarily protect a particular metal ion in a mixture from the EDTA reaction. These agents facilitate the sequential analysis of the metal ions by forming stable complexes with some—but not all—metal ions during certain steps.
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
There are many masking agents, such as cyanide, fluoride, triethanolamine, thiourea, and 2,3-bis(sulfanyl)propan-1-ol (formerly 2,3-dimercapto-1-propanol), with the masking agent chosen based on...
3.4K
Network Function of a Circuit
608
Frequency response analysis in electrical circuits provides vital insights into a circuit's behavior as the frequency of the input signal changes. The transfer function, a mathematical tool, is instrumental in understanding this behavior. It defines the relationship between phasor output and input and comes in four types: voltage gain, current gain, transfer impedance, and transfer admittance. The critical components of the transfer function are the poles and zeros.
608
Line Protection with Impedance Relays
416
Coordinating time-delay overcurrent relays in complex radial systems and directional overcurrent relays in multi-source transmission loops can be challenging. Impedance relays address these issues by responding to the voltage-to-current ratio, specifically measuring the apparent impedance of a line. These relays become more sensitive during faults as current increases and voltage decreases, thereby reducing the apparent impedance.
Under normal conditions, low load currents keep the measured...
Under normal conditions, low load currents keep the measured...
416
Fast Decoupled and DC Powerflow
714
The fast decoupled power flow method addresses contingencies in power system operations, such as generator outages or transmission line failures. This method provides quick power flow solutions, essential for real-time system adjustments. Fast decoupled power flow algorithms simplify the Jacobian matrix by neglecting certain elements, leading to two sets of decoupled equations:
714
